NSA Has Spurred Renewed Interest In Thorough Security Audits Of Popular 'Secure' Software

from the skepticism-is-a-good-thing dept

In yet another bit of fallout from the NSA surveillance efforts -- and, specifically, the NSA's covert takeover of security standards to insert vulnerabilities -- it appears that there's suddenly much more skepticism towards well-known security offerings. This is a good thing. There have already been some revelations concerning attempts to compromise Tor, and security researcher Matthew Green has now called for a thorough security audit of TrueCrypt, the (very) popular disk encryption tool. Green and some others have kicked off the project on the aptly named website IsTrueCryptAuditedYet.com.

As Green notes, he is not suggesting that TrueCrypt is not secure, or that it's been compromised, but that in this day and age, security software needs to be properly audited -- and, if anything, hopefully the results of such an audit will be either more secure software or more confidence that TrueCrypt really is secure.

Maybe nothing at all. Rest assured if I knew of a specific problem with Truecrypt, this post would have a very different title -- something with exclamation points and curse words and much wry humor. Let me be clear: I am not implying anything like this. Not even a little.

The 'problem' with Truecrypt is the same problem we have with any popular security software in the post-September-5 era: we don't know what to trust anymore. We have hard evidence that the NSA is tampering with encryption software and hardware, and common sense tells us that NSA is probably not alone. Truecrypt, as popular and widely trusted as it is, makes a fantastic target for subversion.

But quite frankly there are other things that worry me about Truecrypt. The biggest one is that nobody knows who wrote it. This skeeves me out. As Dan Kaminsky puts it, 'authorship is a better predictor of quality than openness'. I would feel better if I knew who the TrueCrypt authors were.

Now please don't take this the wrong way: anonymity is not a crime. It's possible the Truecrypt developers are magical security elves who are simply trying to protect their vital essence. More prosaically, perhaps they live in a country where privacy advocates aren't as revered as they are in the US. (I kid.)

Hopefully, the end result of this new found skepticism towards popular security products will lead to a world in which we really are more secure, rather than one in which the NSA just has people thinking they're more secure.

It is good that the revelations that have been brought forth from the Snowden data release is seeing effective changes to how things are done and questions to what was assumed to be safe software.

People already trust this government far less than it needed to be. But government actions willing to cover up and hide methodology and workings that make things untrustworthy have been shown to be what it seeks often.

One would think after years of enforcement that medical data as well as personal data has protected status is now being upended. I'll just drop this here...

What gets me is that as someone who has been using Truecrypt for years, until all this NSA bullshit, I never even thought about whether or not my own government had subverted it. Since all the NSA bullshit started though, I've managed to curtail damn near everything that I do online. While I still use TOR for certain research and I still use Truecrypt for certain files, it's pretty god damn arrogant of my own government to make me doubt my own system. It's pretty bad when I have to go offline to do some of the things I need to do, double encrypt something (or more - sometimes four x encryption) it's a sad god damn day that I have to do it in the first place. Yeah, I like run-on sentences plus this rum is DAMN good.

Since I do a lot of pretty high end esoteric math crap, freelance, the LAST thing I want is for some government wonk to get a hold of it and make shit worse.

BUT can you raise even a TINY suspicion of Google, Mike?

It's basically a spy agency like the NSA, operates in utter secrecy, its code planted all over the world to effectively "tap" into tens of millions of sites, billions in revenue yet pays almost no taxes, hides the money in offshore havens... With all that, could you ankle-biters toss me a bone and say that Google is not entirely above suspicion?Where Mike sez: "Any system that involves spying on the activities of users is going to be a non-starter. Creeping the hell out of people isn't a way of encouraging them to buy. It's a way of encouraging them to want nothing to do with you." -- So why doesn't that apply to The Google?10:58:26[l-365-8]

Re: Re: BUT can you raise even a TINY suspicion of Google, Mike?

Encryption isn't enough

NSA thinks what it's doing is OK, but it is all wrong, as these comments overwhelmingly agree. The system is broke, and logic dictates that we take matters into our own hands. Start using encryption, stop using public cloud storage and move everything to a Cloudlocker (www.stoamigo.com) which works the same but stays in your home where they still need a warrant to get it. I'm sure good ol Yankee ingenuity will come up with more inventions like this to protect us from the people supposed to protect us.

Re: What about the compilers?

Just because the source code is fine doesn't mean the compiled executables consist solely of the audited source code.

From the page the story links to:

Implement deterministic/reproducible builds. Many of our concerns with Truecrypt could go away if we knew the binaries were compiled from source. Unfortunately it's not realistic to ask every Windows user to compile Truecrypt themselves. Our proposal is to adapt the deterministic build process that Tor is now using, so we can know the binaries are safe and untampered. This is really a precondition to everything else. And it's not an easy process.

Watch for the obvious

I use truecrypt, but probably shouldn't given my anti-NSA stance.

What strikes me about the most obvious attack method is the reboots. I've received lots of Windows updates recently, and a lot of them do a double reboot. Well at least they look like a reboot. There's a screen and it looks like truecrypt asking for a password, but then again, it could just be a password phishing screen.

Fundamentally I don't trust the Windows computer in front of me, and am migrating to a Centos box.

Passwords etc. they're being moved off to a non-connected box and changed.

These are difficult times. MI5 is calling discussion life-threatening, GCHQ is outside the law and working for a foreign government. Astroturfer in coordination with Andrew Parker's remarks, make death threats against Snowden and newspaper editors.

I think people don't take their own security strongly enough until its too late.